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CLAIMS 

1. A method of modelling a state machine comprising a first state 
model (clienti), and a second state model (mf1) implementing a function 

5 call, the method comprising, in response to an event in the first state model 
instructing the firing of the function call, implanting the second state model 
in the first state model. 

2. A method according to claim 1 , in which the second state model 
10 is absent of history information. 

3. A method according to either preceding claim, in which the 
second state model contains one or more clusters (clienti, client2). 

15 4. A method according to any preceding claim, in which the second 

state model contains one or more sets (system). 

5. A method as claimed in any preceding claim, in which the second 
state model contains two or more leafstates (f1_a, f1_b) having one or more 

20 event driven transitions (p) therebetween. 

6. A method as claimed in claim 5, in which one or more of the 
transitions fires a notification event (pending_f, finaLnotif_g). 

25 7. A method as claimed in any preceding claim, in which the second 

state model is implanted over an explicit marker state (calling) of the first 
state model. 

8. A method as claimed in any of claims 1 to 6, in which the second 
30 state model is implanted over an implicit marker state of the first state 
model. 
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9. A method as claimed in claim 7 or claim 8, in which the second 
state model is deleted on completion. 

10. A method as claimed in claim 9, in which the model allows the 
5 entering of a state in the first model local to the caller of the second state 

model only on deletion of the second state model. 

11. A method as claimed in any of claims 7 to 10, in which local 
declarations and/or scoping operators are used in the second state model. 

10 

12. A method as claimed in claim 11, in which a return event from 
the second state model uses a "back" scoping operator ($). 

13. A method as claimed in any of claims 1 to 5, in which the second 
15 state model is implanted in free-space. 

14. A method as claimed in claim 13, in which the lifetime of the 
second state model is independent of any other model. 

20 15. A method as claimed in claim 13 or claim 14, in which the second 

state model is implanted local to the caller of the second state model. 

16, A method as claimed in any of claims 13 to 15, in which 
notification events from the second state model are global. 

25 

17. A method as claimed in any of claims 13 to 17, in which the 
second state model is deleted on transition to a terminator forming part 
thereof. 

30 18. A method as claimed in any preceding claims, in which events 

occurring in the second state model are parameterised. 
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19. A method as claimed in any preceding claim, in which events 
occurring in the first state model are parameterised. 

20. A computer program containing instructions for a computer to 
5 carry out the method of any of claims 1 to 18. 

21. A computer program as claimed in claim 19, further comprising 
instructions for a computer to generate an executable program exhibiting 
the same behaviour as the state model. 

10 

22. A computer program as claimed in claim 19 or claim 20, further 
comprising instructions for a computer to generate tests with an oracle, for 
testing an implementation conformant to the behaviour of the state model. 

15 23. A computer programmed with the computer program of claim 1 9. 

24. Apparatus for modelling a state machine comprising a first state 
model (clienti) and a second state model (mfl) implementing a function 
call, the apparatus comprising means responsive to an event in the first 

20 state model instructing the firing of the function call, for implanting the 
second state model in the first state model. 

25. Apparatus according to claim 24, in which the second state 
model contains one or more clusters (clienti , client2). 

25 

26. Apparatus according to claim 24 or claim 25, in which the second 
state model contains one or more sets (system). 

27. Apparatus according to any of claims 24 to 26, in which the 
30 second state model contains two or more leafstates (f1_a, f1_b) having one 

or more event driven transitions (P) therebetween. 
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28. Apparatus as claimed in any of claims 24 to 27, in which one or 
more of the transitions fires a notification event (pending^f, finaLnotif_g). 

29. Apparatus as claimed in any of claims 24 to 28, in which the 
5 second state model is implanted over an explicit marker state (calling) of the 

first state model. 

30. Apparatus as claimed in any of claims 24 to 28, in which the 
second state model is implanted over an implicit marker state of the first 

10 state model. 

31. Apparatus as claimed in claim 29 or claim 30, comprising means 
for deleting the second state model on completion. 

15 32. Apparatus as claimed in claim 31, in which the model allows the 

entering of a state in the first model local to the caller of the second state 
model only on deletion of the second state model. 

33. Apparatus as claimed in any of claims 24 to 28, in which the 
20 second state model is implanted in free-space. 

34. Apparatus as claimed in claim 33, in which the second state 
model, is implanted local to the caller of the second state model. 

25 35. Apparatus as claimed in claim 33 or claim 34, comprising means 

for deleting the second state model on transition to a terminator forming part 
thereof. 



